Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For awhile now a user is having issues with his AD account locking up a few times a day.

I have enabled the audit logs in windows GPO to show login attempts and pushed it out to our 3 domain controllers.

They werent really showing anything (failure wise) so i went to the users workstation and looked at event viewer and its not showing that he failed to login 5 times. this leads me to believe its something more to do with email as his domain account cannot be accessed outside the building, and this problem started when he updated his password 2 weeks ago.

I've been searching for a way to look at exchange 2010s audit logs for failed login attempts but i have not been able to find anything beyond the GPO i have already setup.

Does anyone have any idea on this? The next thing i'm thinking is to change his login usersname and that would make so any email accounts he had setup at home/anywhere wouldnt lock the account anymore.

Any advice would be awesome!

Thanks guys

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If the user account locked, then failed authentications to the domain controllers did occur - this includes if the failures were attempts to hit Exchange, which authenticates via the domain controllers.

Sounds like there's something wrong with the audit logging that you're doing on the DCs - you should be able to generate a failed login and verify that it's properly logged on one of the domain controllers. In addition, you should be able to find the event where the lockout was applied to the account and use that timestamp to find relevant login failure events.

share|improve this answer
    
it seems it just took a bit for the policies to push out. looking into the event logs more on the exchange server now shows correctly. –  lbakerit Nov 19 '12 at 14:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.